| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "core/loader/HttpEquiv.h" | 5 #include "core/loader/HttpEquiv.h" |
| 6 | 6 |
| 7 #include "core/dom/Document.h" | 7 #include "core/dom/Document.h" |
| 8 #include "core/dom/ScriptableDocumentParser.h" |
| 8 #include "core/dom/StyleEngine.h" | 9 #include "core/dom/StyleEngine.h" |
| 9 #include "core/fetch/ClientHintsPreferences.h" | 10 #include "core/fetch/ClientHintsPreferences.h" |
| 10 #include "core/frame/UseCounter.h" | 11 #include "core/frame/UseCounter.h" |
| 11 #include "core/frame/csp/ContentSecurityPolicy.h" | 12 #include "core/frame/csp/ContentSecurityPolicy.h" |
| 12 #include "core/html/HTMLDocument.h" | 13 #include "core/html/HTMLDocument.h" |
| 13 #include "core/inspector/ConsoleMessage.h" | 14 #include "core/inspector/ConsoleMessage.h" |
| 14 #include "core/loader/DocumentLoader.h" | 15 #include "core/loader/DocumentLoader.h" |
| 16 #include "core/origin_trials/OriginTrialContext.h" |
| 17 #include "platform/HTTPNames.h" |
| 15 #include "platform/network/HTTPParsers.h" | 18 #include "platform/network/HTTPParsers.h" |
| 16 #include "platform/weborigin/KURL.h" | 19 #include "platform/weborigin/KURL.h" |
| 17 | 20 |
| 18 namespace blink { | 21 namespace blink { |
| 19 | 22 |
| 20 void HttpEquiv::process(Document& document, const AtomicString& equiv, const Ato
micString& content, bool inDocumentHeadElement) | 23 void HttpEquiv::process(Document& document, const AtomicString& equiv, const Ato
micString& content, bool inDocumentHeadElement) |
| 21 { | 24 { |
| 22 ASSERT(!equiv.isNull() && !content.isNull()); | 25 ASSERT(!equiv.isNull() && !content.isNull()); |
| 23 | 26 |
| 24 if (equalIgnoringCase(equiv, "default-style")) { | 27 if (equalIgnoringCase(equiv, "default-style")) { |
| (...skipping 10 matching lines...) Expand all Loading... |
| 35 processHttpEquivXFrameOptions(document, content); | 38 processHttpEquivXFrameOptions(document, content); |
| 36 } else if (equalIgnoringCase(equiv, "accept-ch")) { | 39 } else if (equalIgnoringCase(equiv, "accept-ch")) { |
| 37 processHttpEquivAcceptCH(document, content); | 40 processHttpEquivAcceptCH(document, content); |
| 38 } else if (equalIgnoringCase(equiv, "content-security-policy") || equalIgnor
ingCase(equiv, "content-security-policy-report-only")) { | 41 } else if (equalIgnoringCase(equiv, "content-security-policy") || equalIgnor
ingCase(equiv, "content-security-policy-report-only")) { |
| 39 if (inDocumentHeadElement) | 42 if (inDocumentHeadElement) |
| 40 processHttpEquivContentSecurityPolicy(document, equiv, content); | 43 processHttpEquivContentSecurityPolicy(document, equiv, content); |
| 41 else | 44 else |
| 42 document.contentSecurityPolicy()->reportMetaOutsideHead(content); | 45 document.contentSecurityPolicy()->reportMetaOutsideHead(content); |
| 43 } else if (equalIgnoringCase(equiv, "suborigin")) { | 46 } else if (equalIgnoringCase(equiv, "suborigin")) { |
| 44 document.addConsoleMessage(ConsoleMessage::create(SecurityMessageSource,
ErrorMessageLevel, "Error with Suborigin header: Suborigin header with value '"
+ content + "' was delivered via a <meta> element and not an HTTP header, which
is disallowed. The Suborigin has been ignored.")); | 47 document.addConsoleMessage(ConsoleMessage::create(SecurityMessageSource,
ErrorMessageLevel, "Error with Suborigin header: Suborigin header with value '"
+ content + "' was delivered via a <meta> element and not an HTTP header, which
is disallowed. The Suborigin has been ignored.")); |
| 48 } else if (equalIgnoringCase(equiv, HTTPNames::Origin_Trial)) { |
| 49 if (inDocumentHeadElement) |
| 50 OriginTrialContext::from(&document)->addToken(content); |
| 45 } | 51 } |
| 46 } | 52 } |
| 47 | 53 |
| 48 void HttpEquiv::processHttpEquivContentSecurityPolicy(Document& document, const
AtomicString& equiv, const AtomicString& content) | 54 void HttpEquiv::processHttpEquivContentSecurityPolicy(Document& document, const
AtomicString& equiv, const AtomicString& content) |
| 49 { | 55 { |
| 50 if (document.importLoader()) | 56 if (document.importLoader()) |
| 51 return; | 57 return; |
| 52 if (equalIgnoringCase(equiv, "content-security-policy")) | 58 if (equalIgnoringCase(equiv, "content-security-policy")) |
| 53 document.contentSecurityPolicy()->didReceiveHeader(content, ContentSecur
ityPolicyHeaderTypeEnforce, ContentSecurityPolicyHeaderSourceMeta); | 59 document.contentSecurityPolicy()->didReceiveHeader(content, ContentSecur
ityPolicyHeaderTypeEnforce, ContentSecurityPolicyHeaderSourceMeta); |
| 54 else if (equalIgnoringCase(equiv, "content-security-policy-report-only")) | 60 else if (equalIgnoringCase(equiv, "content-security-policy-report-only")) |
| (...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 104 frame->loader().stopAllLoaders(); | 110 frame->loader().stopAllLoaders(); |
| 105 // Stopping the loader isn't enough, as we're already parsing the document;
to honor the header's | 111 // Stopping the loader isn't enough, as we're already parsing the document;
to honor the header's |
| 106 // intent, we must navigate away from the possibly partially-rendered docume
nt to a location that | 112 // intent, we must navigate away from the possibly partially-rendered docume
nt to a location that |
| 107 // doesn't inherit the parent's SecurityOrigin. | 113 // doesn't inherit the parent's SecurityOrigin. |
| 108 // TODO(dglazkov): This should probably check document lifecycle instead. | 114 // TODO(dglazkov): This should probably check document lifecycle instead. |
| 109 if (document.frame()) | 115 if (document.frame()) |
| 110 frame->navigate(document, SecurityOrigin::urlWithUniqueSecurityOrigin(),
true, UserGestureStatus::None); | 116 frame->navigate(document, SecurityOrigin::urlWithUniqueSecurityOrigin(),
true, UserGestureStatus::None); |
| 111 } | 117 } |
| 112 | 118 |
| 113 } // namespace blink | 119 } // namespace blink |
| OLD | NEW |